---
id: "CVE-2026-107014"
kind: "vulnerability"
aliases: ["CVE-2026-107014"]
title: "Bander Notepad: insecure permissions let attackers read and write other users' notes"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "bander.notepad", "package"]
not_affected_if: ["other-app-version"]
published_at: "2026-10-29T15:17:15+00:00"
first_seen_at: "2026-10-29T15:25:38+00:00"
updated_at: "2026-10-29T15:27:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107014", "first_seen_at": "2026-10-29T15:25:38+00:00"}]
---

# Bander Notepad: insecure permissions let attackers read and write other users' notes

Bander Notepad (bander.notepad) versionCode 12 has insecure file permissions on its note database. An unauthorized attacker can read and write notes stored in another user's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed app version for `bander.notepad` versionCode 12

## Timeline

- 2026-10-29T15:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107014

## From the sources

Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_